registry / @telemetry-tracker/core / 1.5.0
@telemetry-tracker/core@1.5.0
Lightweight telemetry client: events, errors, sessions. Framework-agnostic core.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoint and supporting modules implement ordinary telemetry behavior without a concrete attack chain. Network hints reflect configured ingest requests, while secret-pattern hints reflect redaction expressions.
Static reason
One or more suspicious static signals were detected.
Trigger
The caller invokes init and telemetry APIs; installation and import do not initiate telemetry requests.
Impact
Expected telemetry collection and anonymous identifier storage; no confirmed malicious execution, credential harvesting, or control-surface mutation.
Mechanism
The client posts events, errors, sessions, and browser metrics to the configured ingest destination using a caller-supplied API key.
AI rationale
The inspected entrypoint and supporting modules implement ordinary telemetry behavior without a concrete attack chain. Network hints reflect configured ingest requests, while secret-pattern hints reflect redaction expressions.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build, dev, and test scripts, with no automatic installation lifecycle hooks or runtime self-dependency.
- dist/index.js activates telemetry through init using caller-supplied configuration.
- Telemetry destinations derive from the caller's ingestUrl, and authorization uses the caller's apiKey.
- Network requests post telemetry payloads with the configured authentication headers.
- dist/pii-scrub.js replaces token and API key patterns with redaction placeholders.
Evidence against
Behavioral surface
Network
Source & flagged code
7 flaggeddist/pii-scrub.jsView file
23patternName = generic_password
severity = medium
line = 23
Medium
56out = out.replace(JWT_RE, "[token]");
out = out.replace(BEARER_RE, "[bearer-token]");
out = out.replace(API_KEY_RE, "[api-key]");
out = sc
Low
Ai Review Evidence
dist/pii-scrub.js replaces token and API key patterns with redaction placeholders.
dist/pii-scrub.jsView on unpkg · L56package.jsonView file
38"scripts": {
"build": "node scripts/inject-version.cjs && rm -rf dist && tsc",
"dev": "tsc --watch",
"test": "vitest run"
}
}
Low
Suspicious Lifecycle Evidence
package.json defines build, dev, and test scripts, with no automatic installation lifecycle hooks or runtime self-dependency.
Findings
4 Medium5 Low
MediumSecret Patterndist/pii-scrub.js
MediumNetwork
MediumStripped Provenance Metadatadist/index.js
MediumStripped Provenance Metadatadist/index.js
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/pii-scrub.js
Affected versions and remediation
This report applies to @telemetry-tracker/core@1.5.0.
See all versions of @telemetry-tracker/core for other recorded verdicts.
- Review the evidence and your use of @telemetry-tracker/core@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.